docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

drop CAP_SYSLOG capability 

Kernel capabilities for privileged syslog operations are currently splitted into
CAP_SYS_ADMIN and CAP_SYSLOG since the following commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce6ada35bdf710d16582cc4869c26722547e6f11

This patch drops CAP_SYSLOG to prevent containers from messing with
host's syslog (e.g. `dmesg -c` clears up host's printk ring buffer).

Closes #5491

Docker-DCO-1.1-Signed-off-by: Eiichi Tsukata <devel@etsukata.com> (github: Etsukata)
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Eiichi Tsukata 2014-04-30 15:20:22 +09:00 committed by Michael Crosby
parent fe4a25546a
commit cac0cea03f
4 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
daemon/execdriver/lxc/init.go
View File

@ -149,6 +149,7 @@ func setupCapabilities(args *execdriver.InitArgs) error {
capability.CAP_MAC_OVERRIDE, capability.CAP_MAC_OVERRIDE,
capability.CAP_MAC_ADMIN, capability.CAP_MAC_ADMIN,
capability.CAP_NET_ADMIN, capability.CAP_NET_ADMIN,
capability.CAP_SYSLOG,
} }
c, err := capability.NewPid(os.Getpid()) c, err := capability.NewPid(os.Getpid())

1
daemon/execdriver/native/template/default_template.go
View File

@ -25,6 +25,7 @@ func New() *libcontainer.Container {
libcontainer.GetCapability("MAC_ADMIN"), libcontainer.GetCapability("MAC_ADMIN"),
libcontainer.GetCapability("NET_ADMIN"), libcontainer.GetCapability("NET_ADMIN"),
libcontainer.GetCapability("MKNOD"), libcontainer.GetCapability("MKNOD"),
libcontainer.GetCapability("SYSLOG"),
}, },
Namespaces: libcontainer.Namespaces{ Namespaces: libcontainer.Namespaces{
libcontainer.GetNamespace("NEWNS"), libcontainer.GetNamespace("NEWNS"),

5
pkg/libcontainer/container.json
View File

@ -91,6 +91,11 @@
"value" : 27, "value" : 27,
"key" : "MKNOD", "key" : "MKNOD",
"enabled" : true "enabled" : true
},
{
"value" : 34,
"key" : "SYSLOG",
"enabled" : false
} }
], ],
"networks" : [ "networks" : [

1
pkg/libcontainer/types.go
View File

@ -53,6 +53,7 @@ var (
{Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE, Enabled: false}, {Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE, Enabled: false},
{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN, Enabled: false}, {Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN, Enabled: false},
{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN, Enabled: false}, {Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN, Enabled: false},
{Key: "SYSLOG", Value: capability.CAP_SYSLOG, Enabled: false},
} }
) )